[HBASE-10823] Resolve LATEST_TIMESTAMP to current server time before scanning for ACLs

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 0.98.1
• Fix Version/s: 0.99.0, 0.98.2
• Hadoop Flags: Reviewed
• Assignee: Andrew Purtell
• Reporter: Andrew Purtell
• Created: 25/Mar/14 01:58
• Updated: 21/Feb/15 23:35
• Resolved: 15/Apr/14 17:56

Description

Storing values with timestamps in the future is probably bad practice and can lead to surprises. If cells with timestamps in the future have ACLs, permissions from those ACLs will incorrectly be considered for authorizing the pending mutation. For sure that will be surprising.

We should be able to avoid this case by resolving LATEST_TIMESTAMP to the current server time when creating the internal scanner for finding ACLs in the covered cell set.

Documenting a todo item from a discussion between Anoop Sam John and myself.

Issue Links

• is related to: HBASE-10964 Delete mutation is not consistent with Put wrt timestamp
• relates to: HBASE-10970 [AccessController] Issues with covering cell permission checks

Sub-Tasks

• Refactor cell ACL tests: Closed